DE102008002738B4 - Method for detecting a faulty node - Google Patents

Abstract

Method for detecting a faulty node (2) connected to a bus (3),
the node (2) increments an internal error counter (FZ) in a normal operating state upon detection of a fault,
wherein the node (2) switches to an isolated operating state in which the node (2) does not exchange messages via the bus (3) when the internal error counter (FZ) of the node (2) exceeds a predetermined error threshold,
wherein upon fulfillment of a condition, the node (2) switches from the isolated operating state to the normal operating state and this state change is detected, and
wherein the node (2) is detected as defective if a rate of the detected state change exceeds an adjustable change rate or a number of the detected state change exceeds an adjustable state change threshold.

Description

The The present invention relates to a method for detecting a faulty node connected to a bus, and in particular a method for detecting a faulty node that is connected to a CAN bus is connected.

The DE 39 28 537 A1 describes a method for error detection or error localization in data transmissions. This detects a faulty node connected to a bus. When an error is detected, an internal error counter is incremented in a normal operating state. The node enters an isolated operating state in which the node does not exchange messages over the bus when the node's error counter exceeds a predetermined error threshold. When a condition is met, the node switches from the isolated mode to the normal mode.

The DE 10 2007 004 701 B4 describes a method for operating a mixer of a heating system in which a state change is evaluated.

node or participants of a CAN bus (CAN: Controller Area Network) communicate together according to a CAN bus protocol. The CAN bus is an asynchronous, serial bus system for networking ECUs. The number of connected Participant or node depends on the bus driver blocks used.

Of the CAN bus is multi-master capable, d. H. every single node of the bus system is capable of communication initiate. The CAN bus uses the access technology CSMA / CD + CR (Carrier Sense, Multiple Access / Collision Detection + Collision Resolution). The bus access is identified by means of an arbitration based on the over transferred the bus Messages performed. The communication between the nodes takes place with messages or Telegrams, which are also called frames. With a CAN bus can transmit four different types of frames or messages become. In addition to data messages for transporting messages is different You can also call so-called remote frames, overload frames and error frames. A remote frame or a remote message is used to request a data frame from another participant or node. An overload frame serves as a forced break between one Data and a remote frame. An error frame signals one Node of a detected error in the data transfer.

One Node or a CAN controller is capable of errors during transmission to recognize. For example, you can Bit error, bit stuffing error, CRC error, format error in one Telegram and acknowledgment errors are detected. Will one If this error is detected by a node, the node notifies the remaining Node of the bus system and the sender of the telegram or the message by the node sending an error frame. After receiving an error frame all participants or nodes evaluate the received message and also begin sending an error frame.

faulty Messages can by external sources of interference outside of the bus system or caused by malfunction of a CAN station. Around Ensure that there is a broken node that is not in able to receive messages correctly, the entire network or the entire bus system is blocked is in each node or each CAN controller of the bus system implemented an algorithm with its help, the node help in the event of an error step by step from the bus withdraws. Represents a CAN controller or a node determines that it is the first network node or node Error frame sent has increased he has an internal error counter TEC (Transmit Error Counter). As long as the value of the error counter is under is a threshold value, the CAN controller sends in the event of an error Error frames. The threshold for the error counter is for example at 127. This mode of operation represents the normal one Operating state of the node is and is also referred to as an error-active operating state. Lies the value of the error counter TEC over the threshold of 127, the CAN controller goes into a so-called Error-passive operating mode via. In this operating mode, the CAN controller sends a 6-bit error frame with a recessive one Signal level off. If the error counter TEC has a level of 255 has reached, the CAN controller in the so-called bus-off operating state switched and no longer takes over the communication over the CAN bus part. In the bus-off mode of operation is the node in an isolated operating state, in which the node no News about exchanges the bus. From the error-passive mode, the CAN controller can free yourself as the error counter is decremented if another participant or node fails first recognized.

1 shows a state diagram illustrating an exception or error handling within a conventional CAN controller. The CAN controller has two counters or counters, namely a TEC counter (TEC: Transmitting Error Counter) and a REC counter (REC: Receiving Error Counter). The CAN node transmits and receives messages or telegrams that the node checks for correctness. in case of a Error in a transmitted message counts the internal counter TEC the number of detected errors, so that the node of in 1 can take shown states. If the node is in the isolated operating state (bus-off), the node does not participate in the communication until a condition for the transition to the normal error state (Error Active) is fulfilled. The condition is, for example, an occurrence of successive recessive bits on the data bus.

In the 1 illustrated error handling of the CAN bus data transmission protocol (error handling) ensures that a minimum of communication can take place. The error handling secures the communication of a functioning CAN bus with one or more faulty nodes.

In the 1 However, the prior art error treatment illustrated has some disadvantages. How to get out 1 can detect, a faulty node or a faulty node of the bus system over a longer period disrupt the communication on the bus, without that his misconduct is recorded or displayed. In the conventional error handling neither an evaluation of the error rate, nor a qualitative assessment of the error occurring with its possible consequences. A permanently faulty node may be the three in 1 Run through the operating states shown without its erroneous behavior is detected in time. Since no error evaluation is carried out for a constantly faulty CAN bus node, this node can not be exchanged specifically. Since a permanently faulty CAN node can not be recognized immediately, additional redundant nodes are provided especially for safety-critical applications. If the CAN bus within a vehicle is increased by the additional number of redundant nodes and thus the total weight of the vehicle. Due to the increased total weight, the fuel consumption of the vehicle increases. Furthermore, a constant malfunction of the CAN bus node can lead to a device failure and reduce the availability of the corresponding bus system.

It is therefore an object of the present invention, a method to create a faulty node of a bus on time recognizes.

These The object is achieved by a Method with the features specified in the patent claim 1 solved.

The invention provides a method for detecting a faulty node connected to a bus,
wherein the node increments an internal error counter in a normal operating state upon detection of a fault,
wherein the node switches to an isolated mode in which the node does not exchange messages over the bus when the internal error counter of the node exceeds a predetermined threshold,
wherein upon satisfaction of a condition, the node switches from the isolated operating condition to the normal operating condition and detecting this status change, and
wherein the node is detected as defective when a rate of the detected state changes exceeds an adjustable change rate or a number of the detected state changes exceeds a state transition threshold.

at an embodiment the method according to the invention becomes a state change counter incremented when a state change from the isolated operating state is detected in the normal operating state.

at an embodiment the method according to the invention a state change counter is provided in each node.

at an alternative embodiment the method according to the invention is for each node has an associated one State change counter provided in a master node.

at an embodiment the method according to the invention a node indicates a state change from the isolated operating state in the normal operating state by means of a message sent over the bus or over a communication channel separate from the bus to the master node.

at an embodiment the method according to the invention sends the node upon detection of an error in the transmission a message about the bus an error message about the bus out.

The invention further provides a node for a bus having an internal error counter which is incremented upon detection of an error,
the node, in a normal operating state, switching to an isolated operating state in which the node does not exchange messages over the bus when the internal error counter exceeds a predetermined counter threshold,
wherein upon satisfaction of a condition, the node switches from the isolated operating state back to the normal operating state, wherein the node associated state change counter is provided, which is incremented at each state change of the node from the isolated operating state in the normal operating state,
wherein the node is identified as faulty if the associated state change counter exceeds an adjustable state change threshold.

at an embodiment of the knot according to the invention is the state change counter integrated in the node.

at an alternative form of the node according to the invention is the state change counter in one Master node integrated, over the bus is connected to the node.

at an embodiment of the knot according to the invention the node is a CAN node connected to a CAN bus is, which is installed inside a vehicle.

at an embodiment of the knot according to the invention the vehicle is an aircraft.

The invention further provides a computer program product having program instructions for performing a method of detecting a faulty node connected to a bus, the node incrementing an internal error counter in a normal operating state upon detection of a fault,
the node switching to an isolated mode in which the node does not exchange messages over the bus when the internal error counter of the node exceeds a predetermined error threshold,
wherein upon satisfaction of a condition, the node switches from the isolated operating condition to the normal operating condition and detecting this status change, and
wherein the node is detected as defective if a rate of the detected state change exceeds an adjustable change rate or a number of the detected state change exceeds an adjustable state change threshold.

The The invention further provides a data carrier storing such a computer program product.

in the Other preferred embodiments the process of the invention and the bus node according to the invention with reference to the attached Figures for explanation features essential to the invention described.

It demonstrate:

1 a state diagram illustrating an error handling in a CAN bus according to the prior art;

2 a block diagram illustrating an error treatment in a first embodiment of the method according to the invention for detecting a faulty node;

3 shows a block diagram illustrating an error handling in another embodiment of the method according to the invention for detecting a faulty node;

4 shows a block diagram illustrating an error handling in another embodiment of the method according to the invention for detecting a faulty node;

5 a state diagram for illustrating the method according to the invention.

2 shows a bus system 1 according to a first embodiment of the invention. Several nodes 2-1 . 2-1 . 2-3 ... 2n are on a common bus 3 connected. In addition, at least one master node 4 by bus 3 connected. At the bus 3 it may, for example, be a field bus, in particular a CAN bus. The knots 2-i are formed, for example, by CAN controllers. These CAN controllers can be integrated in any device.

How to get in 2 can recognize, each node has an internal error counter FZ. In a normal operating state of the node 2 the associated internal error counter FZ of the node is incremented upon detection of an error. The error detection can take place on different levels. At message levels, for example, an error detection is implemented by means of a CRC checksum transmitted in the message (CRC: Cycle Redundancy Check). The error detection can also be provided on the physical transmission level. If an error is detected during the transmission of a message over the bus, in one possible embodiment the node sends 2 an error message (error frame) over the bus 3 off and increments the integrated error counter FZ.

Exceeds the integrated error counter FZ of the node 2 a predetermined error threshold, the node switches 2 in an isolated operating state (bus-off), in which the node 2 no news on the bus 3 exchanges with other nodes, as in 5 shown. In one possible embodiment, the error threshold is predetermined and amounts to, for example, a CAN bus 255. In an alternative embodiment, the error threshold is adjustable. The thresholds for the various nodes can be set the same or different depending on the application. In another embodiment, the thresholds for the error counters FZ of the various nodes 2 from the master node 4 over the bus 2 set by sending an appropriate message from the Mater node 4 at the respective node 2 is transmitted. In a further embodiment, the threshold value for the error counter FZ is in each case via an interface at the node 2 directly adjustable.

After exceeding the error threshold, the respective node decreases 2 no longer part of the communication and is in an isolated operating state. A knot 2 , which is in the isolated operating state (bus-off), no longer participates in the communication until a condition for the transition or the state change from the isolated operating state to the normal operating state (Error Active) is met. This state change, in which the node or subscriber changes from the isolated operating state back to the normal operating state or is switched, is detected in the inventive method. If a faulty node 2 repeatedly returns from the isolated operating state back to a normal operating state, this is detected in the inventive method. This can also be absorbed by additional nodes, provided the causative node 2 structurally is not able to display this information or pass it on to other nodes.

The method according to the invention becomes a node 2 detected as erroneous when a rate of the detected state change exceeds an adjustable change rate. In an alternative embodiment of the method according to the invention becomes a node 2 then detected as defective if an absolute number of the detected state change exceeds an adjustable state change threshold. For this purpose, in one embodiment of the method according to the invention for each node to be monitored 2 an associated To state change counter ZWZ provided. This state change counter ZWZ can as in the 2 illustrated embodiment, for example, in a master node 4 be implemented. How to get out 2 can recognize the master node contains 4 a plurality of registers, wherein for each of the N nodes to be monitored 2 of the bus system 1 an associated state change counter ZWZ is provided. A state change counter ZWZ of a node 2 is incremented when a state change of the node 2 is detected from an isolated operating condition to the normal operating condition. The count values of the state change counters ZWZ or BOC counters (BOC: Bus-off-Counter) can be controlled by a CPU or a microprocessor within the master node 4 be read out and evaluated. The CPU of the master node leads to this 4 in one possible embodiment, a corresponding error handling computer program. In one possible embodiment, a node is shown 2 a state change from the isolated operating state to the normal operating state with one via the bus 3 sent message to the master node 4 at. In one possible embodiment, a message corresponding to the bus message signal transmission protocol is used. Is it the bus 3 for example, to a CAN bus, the node 2 indicate the status change that has occurred by means of a bit or a flag within a CAN message. A normally not set bit within the message is passed through the node 2 is set at a detected state change and points to the master node 4 as a flag occurred state change in the node 2 at.

In an alternative embodiment, the state change is not by means of one over the bus 3 sent message but via a separate communication channel 5 , 3 shows an embodiment in which the nodes 2 over one of the bus 3 separate communication connection 5 to the master node 4 are connected. The knots 2 are able to get over one from the bus 3 separately laid control line 5 the master node 4 indicate that a state change has occurred from the isolated operating state to the normal operating state. In the separate communication channel 5 it can also be another bus or fieldbus. At the in 3 illustrated embodiment is the communication channel 5 wired. In an alternative embodiment, communication channel 5 also be implemented wirelessly. The nodes transmit 2 via a wireless interface, a message to the master node 4 that says that at the respective node 2 a state change has occurred. At the in 2 and 3 The embodiments shown are the state change counters ZWZ in a master node 4 implemented and are evaluated there.

At the in 4 In the illustrated embodiment, the state change counters ZWZ of the various nodes 2 inside the node 2 implemented. A knot 2 is recognized as faulty if its integrated state change counter ZWZ exceeds an adjustable state change threshold. Only when this state change threshold value is exceeded does the node send 2 an appropriate message over the bus 3 for example, to inform a user about a necessary maintenance procedure as in 5 shown. At the in 4 illustrated embodiment, all nodes 2 Equal rights.

At the in 4 In the embodiment shown, it is also possible that the nodes 2 indicate the crossing of its state transition threshold over a separate communication channel coming from the bus 3 is laid separately. In an alternative embodiment, the nodes report 2-i , the exceeding of the integrated therein state change counter ZWZ via a wireless interface. The via the separate communication channel 5 transmitted signal can be digital, analog or discrete. In one possible embodiment, the various state changes occurring are not only counted but also recorded for later evaluation. The recording can be done by storing the count values of the state change counters ZWZ at different times. In one possible embodiment, the nodes 2-i For this purpose, a readable memory in which the state change counts are recorded over time. These records may, in one possible embodiment, be in a corresponding message exchange over the bus 3 be read out. In an alternative embodiment, the read-out of the records takes place via a separate communication channel. In another embodiment, the records are stored in a local volume that is from the node 2 is removable.

The transmission quality of a node deteriorates 2 due to an error, its state change rate increases. As a result, the value of the responsible state change counter ZWZ of the respective node decreases 2 to. Exceeds the state change counter ZWZ of the node 2 the configured state transition threshold for this node 2 For example, the in 2 illustrated master node 4 to issue a maintenance notice or an alarm message that refers to the faulty node 2 points. This maintenance message or these maintenance instructions can be transmitted via a network to a remote maintenance server. The network may be a wired or wireless network.

Due to the continuous recording of a bus protocol error, it is possible to detect an occurring error or a faulty node occurring 2 clearly identifiable.

The inventive method allows early detection of sources of interference in the bus system 1 without having to be functionally restricted or switched off completely. Thus, despite an announcing error, the further operation of the bus system 1 unrestrictedly possible. In addition, a corresponding maintenance work can be planned and carried out in a targeted manner.

Due to the early detection of potentially faulty nodes, the number of redundant nodes can be used in safety-critical applications 2 be reduced. If the bus system is installed in a vehicle, this reduces the weight of the vehicle.

By the early detection of a faulty CAN bus participant or a node 2 and its early repair or replacement becomes the availability of the bus system 1 elevated. Device failures caused by a malfunction of a node 1 can be prevented, thus can be prevented. In case of misconduct of devices maintenance work is considerably simplified and accelerated by means of the method according to the invention.

1

bus system

2

node

3

bus

4

Master node

5

communication channel

Claims (12)

Method for detecting a faulty node ( 2 ) connected to a bus ( 3 ), the node ( 2 ) in a normal operating state upon detection of an error, an internal error counter (FZ) is incremented, wherein the node ( 2 ) switches to an isolated operating state in which the node ( 2 ) no messages over the bus ( 3 ), if the internal error counter (FZ) of the node (FZ) 2 ) exceeds a predetermined error threshold, upon fulfillment of a condition the node ( 2 ) switches from the isolated operating state to the normal operating state and this state change is detected, and wherein the node ( 2 ) is detected as being erroneous if a rate of the detected state changes exceeds an adjustable change rate or a number of the detected state changes exceeds an adjustable state change threshold. Method according to claim 1, wherein a state change counter (ZWZ) is incremented when a state change of the node (ZWZ) 2 ) is detected from the isolated operating condition to the normal operating condition. Method according to claim 2, wherein in each node ( 2 ) a state change counter (ZWZ) is provided. Method according to claim 1, wherein for each node ( 2 ) an associated state change counter (ZWZ) in a master node ( 4 ) is provided. Method according to claim 4, wherein a node ( 2 ) a state change from the isolated operating state to the normal operating state by means of a via the bus ( 3 ) or via one of the bus ( 3 ) separate communication channel ( 5 ) the master node ( 4 ). The method of claim 1, wherein the node ( 2 ) upon detection of an error in the transmission of a message over the bus ( 3 ) an error message over the bus ( 3 ). Node ( 2 ) for a bus ( 3 ) with an internal error counter (FZ), which is incremented upon detection of an error, the node ( 2 ) switches from a normal operating state to an isolated operating state when the internal error counter (FZ) exceeds a predetermined error threshold, wherein when a condition is fulfilled the node ( 2 ) switches from the isolated operating state back to the normal operating state, characterized in that a node ( 2 ) associated state change counter (ZWZ) is provided which at each state change of the node ( 2 ) is incremented from the isolated operating state to the normal operating state, wherein the node ( 2 ) is detected as being erroneous when the associated state change counter (ZWZ) exceeds an adjustable state change threshold. Node according to claim 7, wherein the state change counter (ZWZ) in the node ( 2 ) or in a master node ( 4 ) which is connected via the bus ( 3 ) with the node ( 2 ) connected is. A node according to claim 7 or 8, wherein the node ( 2 ) is a CAN node connected to a CAN bus provided inside a vehicle. A node according to claim 9, wherein the vehicle is an aircraft is. Computer program product with program instructions for execution The method according to claims 1 to 6. disk, which stores the computer program product of claim 11.